47c2257df65a955f95b272e30b6a7256673de75a3900ae0f110bacc6f7a2ca14

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowWizardT.exe
Size

212KB
MD5

eba67b034e13610daed9f2a87e7ab530
SHA1

5f96f1d5a4a580c17116774aad88bee700fe7fea
SHA256

c5281a298f7fc386288b28be0fd35388dbd00ec1cdfbaa74fab772c4cc1ae1d8
SHA512

a71c04e0472e5fc556fb7d3dcdc8a281bdb9c1b05388e3e7b3098acc563395646c7627dd96f7371252ef64a2670ea09c5afaece8a5b89586bcd81b477b49a793
SSDEEP

1536:CXXXxL4G9svW0SIQ5kPNXDQfrM1qd1Li:iHR4G9IVk5kPNXDQfrMI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2360	WindowWizardT.exe
2360	WindowWizardT.exe
2964	WindowWizard.exe
2964	WindowWizard.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2964	2360	WindowWizardT.exe	30
PID 2360 wrote to memory of 2964	2360	WindowWizardT.exe	30
PID 2360 wrote to memory of 2964	2360	WindowWizardT.exe	30
PID 2360 wrote to memory of 2964	2360	WindowWizardT.exe	30

C:\Users\Admin\AppData\Local\Temp\WindowWizardT.exe
"C:\Users\Admin\AppData\Local\Temp\WindowWizardT.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\WindowWizard.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowWizard.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...